STUPID-2026-0165
PixelLeak: AI coding agents pushed 13,000+ internal screenshots, including billing records, to public GitHub repos at 300+ organizations
Why 10/10
Confirmed real-world exposure (not a lab test or benchmark) across 300+ organizations via a pattern baked into a skill usable by 40+ coding agents — mass exposure in a widely used tool, not one org (scope 4). Images sat in public repos, downloadable with no login, before anyone was notified; once public, exposure can't be undone even after takedown (recoverability 3). This is documented real-use harm, not a demonstrated near-miss (realisation 2). Exposed material included customer billing records and an internal treasury/settlement console naming a specific client — production data and third-party/customer information (impact 1).
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-11-14
Instruction given
None directed at the exposure itself. Developers asked agents to make a visual/UI change and show that it worked, or installed a shared "skill" (a reusable agent capability, most commonly the open-source tool `gitshot`) that let agents attach screenshots to pull requests for review.
Expected behavior
Screenshots and recordings attached to a PR for human review should stay within the organization's access controls — private to the repo and its reviewers — not land somewhere a security team has no visibility into and the public can download without authentication.
Actual behavior
Until September 1, 2026, GitHub's CLI (`gh`) had no way to attach images to pull requests, issues or comments — that only worked in the browser. CLI-driven agents that needed a reviewer to see a screenshot worked around this by uploading it somewhere else. The most common workaround, the open-source skill `gitshot`, creates a public repository (typically `<username>/gitshot-images`, under the developer's personal GitHub account rather than the org) and stores images as public release assets — the README and skill file say this is public, but it defaults to public and "refuses to use a private repository or one owned by an organization." Security firm Glow found the habit spreading inside engineering teams — at one company, agents for several engineers started doing this in early July 2026, and within a week over a dozen developers had the pattern saved as a reusable skill, after which agents uploaded 1,000+ screenshots, recordings and summaries of unreleased features. Because the images sat under personal accounts rather than org-owned repos, they were invisible to standard corporate security scanning.
Damage
Glow (publishing as "PixelLeak," disclosed 2026-09-29) found more than 13,000 internal images from developers at 300+ organizations sitting in public GitHub repos, discoverable and downloadable by anyone with no login required. Confirmed examples include customer billing records from a utility company (exposed under a manufacturer's developer account until Glow notified them) and, at a financial services firm, screenshots of an internal treasury/settlement console, a withdrawal screen naming a specific client, and recordings of money-movement workflows — plus screenshots of unreleased product features. About a third of affected organizations were exposed via `gitshot` specifically; Glow says the broader pattern showed up across images attributed to several different AI models it did not name. GitHub's `gh` 2.99.0 (released September 1, 2026) added an `--attach` flag that lets agents attach images to PRs/issues directly, removing the reason agents reached for a public-repo workaround in the first place — but does not retroactively secure images already made public, and does not work on GitHub Enterprise Server.
Full write-up
Security research firm Glow disclosed "PixelLeak" on September 29, 2026: more than 13,000 internal screenshots and recordings from developers at over 300 organizations, sitting in public GitHub repositories where anyone could download them without logging in, and which organizations' own security scans never saw because the repos lived under developers' personal accounts rather than their org.
The root cause was a gap in tooling, not a single bad prompt. Until September 1, 2026, GitHub's command-line tool had no way to attach an image to a pull request — that capability existed only in the browser — so CLI-driven coding agents that were asked to show a UI or visual change had no sanctioned way to put a screenshot in front of a human reviewer. Agents and the developers directing them worked around this, most commonly by adopting a shared "skill" called gitshot: an open-source tool that, when it finds an authenticated gh CLI, creates a public repository (typically named <username>/gitshot-images) and uploads screenshots as public release assets. Its own README and skill file disclose that the repository is public, but default to public and explicitly refuse to use a private or organization-owned repo instead.
Glow found the pattern spreading socially inside engineering orgs — at one software company, agents working for several engineers started posting screenshots publicly in early July 2026, and within a week more than a dozen developers had saved it as their own reusable skill, after which those agents uploaded over a thousand screenshots, recordings, and written summaries of unreleased features. Roughly a third of the affected organizations were exposed through gitshot specifically; Glow says the remaining cases came from several unnamed AI models using similar public-upload patterns. Because 93% of the exposed images sat in personal repositories rather than org-owned ones, they were entirely outside the reach of standard corporate security tooling.
Among the confirmed examples: a manufacturer with 100,000+ employees had a utility company's billing records sitting in a developer's public repo until Glow notified them; a financial services firm had screenshots of an internal treasury and settlement console, a withdrawal screen naming a specific client, and recordings of money-movement workflows exposed the same way. GitHub's gh 2.99.0, released September 1, 2026, added an --attach flag that finally lets agents attach images to pull requests and issues directly on GitHub.com and GitHub Enterprise Cloud (not Enterprise Server) — closing the gap that drove agents to the public-repo workaround, but doing nothing to un-expose the images that were already public.
Classification
- Agent
- Multiple agents
- Failure mode
- Security Vulnerability
- Root cause
- Tool Misuse
- Domain
- Security
- Source
- Security Research
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0165: PixelLeak: AI coding agents pushed 13,000+ internal screenshots, including billing records, to public GitHub repos at 300+ organizations." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0165/ (accessed 2026-11-14). CC BY 4.0.
← STUPID-2026-0164By ID
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.